Make sure we can see systemd-resolved's varlink socket

Flatpak user nanonyme warned me that there's a regression in systemd 248 on systems using systemd-resolved's stub resolver, which can be fixed by making sure the container can see the varlink socket.

We should resync that part of the code from Flatpak for better robustness.